Subject: OU's Kerberos 5 changes

From: Jim Shadowen-1 <[email-masked]>
Date: Fri, 28 Mar 1997 09:56:03 -0600

First, several things:
1.	I'm an old C programmer who is new to UNIX, so while this works, it 
may not be the best way to do it.
2.	Wu-ftpd was compiled using the SunOS's (5.5.1) cc compiler.
3.	We are only using Kerberos to verify username and password, the 
user's home directory is still pulled from the password file using the 
original wu-ftpd code.

Changes to ftpd.c:
1.	Before '#ifdef KERBEROS' (approx line 146), added:
#ifdef OUKRB5
#include <sys/types.h>
#include <k5-int.h>
#endif /* OUKRB5 */

2.	Before '#ifdef KERBEROS' (approx line 353), added:
#ifdef OUKRB5
int krb5_authenticate( char *username, char *password );
char krb5_name[ 100 ];
#endif /* OUKRB5 */

3.	Before 'askpasswd = 1;' (approx line 1271), added:
#ifdef OUKRB5
	strcpy( krb5_name, name );
#endif /* OUKRB5 */

4.	Before '#ifdef KERBEROS' (approx line 1418), added:
#ifdef OUKRB5
        ; /* Do nothing with xpasswd */
#else /* OUKRB5 */

5.	Before '#endif' (approx line 1428), added:
#endif

6.	Before '/* If authentication from kerberos fails */' (approx line 
1434), added:
#ifdef OUKRB5
		/* If authentication from kerberos fails */
		if ( krb5_authenticate( krb5_name, passwd ) ) {
#else /* OUKRB5 */

7.	Before '#endif' (approx line 1438), added:
#endif

8.	Before '#ifdef KERBEROS' (approx line 3698), added:
#ifdef OUKRB5
int krb5_authenticate( char *username, char *password )
{
	krb5_context	kcontext;
	krb5_ccache		ccache = NULL;
	krb5_error_code	code;
	krb5_principal	me, server;
	krb5_creds		my_creds;
	char			*client_name;

	krb5_init_context( &kcontext );
	krb5_init_ets( kcontext );

	if ( krb5_cc_default( kcontext, &ccache ) ||
		krb5_parse_name( kcontext, username, &me ) ||
		krb5_unparse_name( kcontext, me, &client_name ) ||
		krb5_cc_initialize( kcontext, ccache, me ) ||
		krb5_build_principal_ext
			( kcontext, &server,
			  krb5_princ_realm( kcontext, me )->length,
			  krb5_princ_realm( kcontext, me )->data,
			  KRB5_TGS_NAME_SIZE,
			  KRB5_TGS_NAME,
			  krb5_princ_realm( kcontext, me )->length,
			  krb5_princ_realm( kcontext, me )->data,
				  0 ) )
	{
		printf( "error when initializing\n" );
		exit( 1 );
	}

	memset( (char *)&my_creds, 0, sizeof( my_creds ) );
	my_creds.client = me;
	my_creds.server = server;
	my_creds.times.starttime = 0;
	my_creds.times.endtime = 0;
	my_creds.times.renew_till = 0;
	code = krb5_get_in_tkt_with_password( kcontext, 0, 0,
NULL, NULL, password,
ccache, &my_creds, 0);
	krb5_free_principal( kcontext, server );
	return( code );
}

#endif /* OUKRB5 */

The Makefile was modified to define:
LKERB    = -lauth -lckrb -lkrb -ldes
	And use it for ftpd.

That's all, folk!!
Good Luck

Jim Shadowen
University of Oklahoma

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Fri, 28 Mar 1997 18:46:27 -0500

Date: Fri, 28 Mar 1997 09:56:03 -0600
   From: Jim Shadowen-1 <[email-masked]>

It's important to note that this is *only* using Kerberos to verify the
username and password.  The Kerberos password is still being sent across
the FTP command channel in the clear, so it's succeptible to
eavesdroppers.  As such, you may *not* want to encourage users to use
this.

There is code in the MIT Kerberos V5 distribution which supports client
authentication, where the ftp client uses Kerberos to authenticate, and
then encrypt the ftp connection to the server.  This requires a version
of the ftp client and server which supports the GSSAPI authentication
extensions.

It would be possible to move this code into wu-ftpd; it would require
pretty siginificant patches, though.  Is this something that Academ
Consulting Services would be willing to see integrated during the 2.5
development cycle?

						- Ted